Data Processing Addendum

Last updated: October 7, 2026

Version française (Addenda sur le traitement des données)

This Data Processing Addendum ("DPA") forms part of the Terms of Service, or of the Master Services Agreement that governs the customer's use of the Services (the "Agreement"), between Neblex LLC ("Neblex") and the customer ("Customer"). It applies whenever Neblex processes Personal Data on Customer's behalf in providing the Services. Terms defined in the Agreement have the same meaning here. If this DPA conflicts with the Agreement, this DPA prevails for the processing of Personal Data; if the Standard Contractual Clauses conflict with this DPA, the Standard Contractual Clauses prevail.

1. Definitions

  • "Data Protection Law" means every law that applies to the processing of Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of the law of the United Kingdom with the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection ("FADP"), Canada's Personal Information Protection and Electronic Documents Act and comparable provincial laws, including Quebec's Act respecting the protection of personal information in the private sector, and the comprehensive privacy laws of the United States states, including the California Consumer Privacy Act as amended ("CCPA").
  • "Personal Data" means any information relating to an identified or identifiable natural person, or "personal information" as Data Protection Law defines it, that Customer or its users submit to, or process through, the Services.
  • "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data processed by Neblex.
  • "Standard Contractual Clauses" means the clauses annexed to European Commission Implementing Decision (EU) 2021/914.
  • "Subprocessor" means a third party Neblex engages to process Personal Data on Customer's behalf.
  • "Controller", "processor", "data subject", "processing", "service provider", "sell", and "share" have the meanings Data Protection Law gives them.

2. Roles and Instructions

Customer is the controller, or a processor acting for its own customers, of the Personal Data it processes with the Services, and Neblex is its processor or service provider. Neblex processes Personal Data only on Customer's documented instructions. The Agreement, this DPA, and Customer's configuration and use of the Services, including the flows, connections, forms, apps, AI agents, and On-Prem Workers Customer sets up, are Customer's complete instructions. Neblex tells Customer if it believes an instruction infringes Data Protection Law, and need not follow that instruction. Where the law requires Neblex to process Personal Data otherwise, Neblex tells Customer first, unless the law forbids it.

Customer is responsible for the lawfulness of the Personal Data and of its instructions, for having a legal basis and giving the notices and obtaining the consents Data Protection Law requires, and for the accuracy of the Personal Data. Customer does not send special categories of Personal Data through the Services unless its configuration and safeguards are appropriate for them.

3. Details of the Processing

  • Subject matter and nature: hosting, transmission, transformation, and storage of data as the Services carry it between the systems Customer connects, for as long as Customer's configuration requires.
  • Purpose: providing, securing, and supporting the Services under the Agreement.
  • Duration: the term of the Agreement and the retrieval period after it (Section 9).
  • Data subjects: as Customer determines, typically Customer's personnel, users, customers, prospects, suppliers, and their contacts.
  • Categories of Personal Data: as Customer determines, typically identification and contact data, account and transaction data, and other data carried in the records Customer's flows process.
  • Frequency: continuous, as Customer's flows run.
  • On-Prem Workers: flows Customer runs on an On-Prem Worker process record data on infrastructure Customer controls; run status, configuration, and control information pass through the Services, and record data reaches the Services only where Customer's configuration asks for it (for example to show a result or a form).

4. Confidentiality

Neblex ensures that everyone it authorizes to process Personal Data is bound by confidentiality obligations and processes it only as this DPA allows.

5. Security

Neblex implements and maintains appropriate technical and organizational measures to protect Personal Data, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as described in Annex II. Neblex may update the measures, but will not reduce the overall level of protection during the term.

6. Subprocessors

Customer gives Neblex general authorization to engage the Subprocessors listed in Annex III. Neblex notifies Customer of a new or replaced Subprocessor at least 30 days in advance by email or in the Services. Customer may object on reasonable grounds relating to data protection within that period; the parties then discuss the objection in good faith, and if they cannot resolve it, Customer may terminate the affected Services and receive a refund of prepaid fees for the remaining term. Neblex imposes on each Subprocessor data protection obligations no less protective than this DPA and remains responsible for its Subprocessors' performance. Providers Customer chooses and connects itself, such as the applications, databases, and AI providers in its flows, are not Neblex's Subprocessors; they act under Customer's own agreements with them.

7. Assistance

Taking into account the nature of the processing, Neblex assists Customer, by appropriate technical and organizational measures and as far as possible, to respond to requests from data subjects exercising their rights, and with security, breach notification, data protection impact assessments, and prior consultation of supervisory authorities. The Services let Customer find, export, correct, and delete the data they hold for Customer. If Neblex receives a request from a data subject about Customer's Personal Data, Neblex refers the data subject to Customer and does not respond itself, except to confirm the referral.

8. Personal Data Breach

Neblex notifies Customer without undue delay, and aims to do so within 48 hours, after becoming aware of a Personal Data Breach. The notice describes, as far as then known, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, and the measures taken or proposed, and Neblex supplements it as more becomes known. Neblex takes reasonable steps to contain and remedy the breach. Notice is not an acknowledgment of fault.

9. Return and Deletion

Customer may export its Personal Data at any time during the term and for 30 days after the Agreement ends. After that period Neblex deletes the Personal Data it holds for Customer, including copies, within a further 60 days, and from backups as they expire in the normal backup cycle, except where the law requires Neblex to keep it, in which case Neblex keeps it confidential and processes it only for that purpose.

10. Audits

Neblex makes available to Customer the information necessary to demonstrate compliance with this DPA and Article 28 of the GDPR, including its security documentation and the results of independent assessments it holds. Where that information is not sufficient, or a supervisory authority requires it, Customer may audit Neblex's compliance once in any 12 months, or after a Personal Data Breach, with at least 30 days' notice, during business hours, at Customer's cost, through an independent auditor bound by confidentiality, and in a way that does not compromise the security or confidentiality of other customers' data.

11. International Transfers

Neblex processes Personal Data in the United States. To the extent Neblex processes Personal Data subject to the GDPR, the UK GDPR, or the FADP in a country that does not provide an adequate level of protection, the following apply and are incorporated into this DPA by reference:

  • EU: the Standard Contractual Clauses, Module Two (controller to processor) where Customer is a controller and Module Three (processor to processor) where Customer is a processor, with Customer as data exporter and Neblex as data importer; the optional docking clause in Clause 7 applies; Option 2 of Clause 9 applies with the notice period in Section 6; the option in Clause 11 does not apply; under Clause 13 the competent supervisory authority is the one determined by Clause 13 for Customer; under Clauses 17 and 18 the law and courts of Ireland apply; and Annexes I to III of this DPA complete the Clauses' annexes.
  • United Kingdom: the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0), completed with the information in this DPA; either party may end it as its Section 19 allows.
  • Switzerland: the Standard Contractual Clauses as above, with references to the GDPR read as references to the FADP, the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority for transfers under the FADP, and the term "member state" read to allow data subjects in Switzerland to bring claims in their place of habitual residence.

Neblex applies supplementary measures appropriate to the transfer, including encryption in transit and of secrets at rest. If an authority requests access to Personal Data, Neblex tells Customer, unless the law forbids it, discloses only what is legally required, and challenges a request it considers unlawful.

12. United States State Privacy Laws

Where the CCPA or another United States state privacy law applies, Neblex acts as Customer's service provider or processor and: (a) does not sell or share Personal Data; (b) does not retain, use, or disclose Personal Data for any purpose other than the business purposes of providing the Services under the Agreement, or outside the direct business relationship with Customer; (c) does not combine Personal Data with personal information it receives from others, except as the law permits; (d) complies with the law that applies to it and provides the same level of privacy protection the law requires; (e) notifies Customer if it can no longer meet its obligations; and (f) allows Customer to take reasonable and appropriate steps to stop and remediate unauthorized use. Neblex certifies that it understands and will comply with these restrictions.

13. Canada

Where Canadian privacy law applies, Neblex uses Personal Data only for the purposes of providing the Services, protects it with safeguards appropriate to its sensitivity, and gives Customer the assistance it needs to meet its accountability obligations.

14. Liability and Term

Each party's liability under this DPA is subject to the limitations of the Agreement, except where Data Protection Law or the Standard Contractual Clauses do not allow them to apply. This DPA lasts as long as Neblex processes Personal Data on Customer's behalf.

Annex I: Parties and Description of the Processing

Data exporter: Customer, as identified in the Agreement and its account, acting as controller or processor; contact details as provided in the account. Data importer: Neblex LLC, acting as processor; contact through the Contact page with the Legal or Privacy subject. Both parties accept these clauses by entering into the Agreement. The description of the processing is Section 3.

Annex II: Technical and Organizational Measures

  • Encryption: TLS for data in transit; credentials, keys, and other secrets sealed at rest with AES-256-GCM under keys separated per workspace; post-quantum signatures on Worker releases and identities.
  • Access control: role-based permissions with least privilege, multi-factor authentication, a fresh sign-in step for sensitive actions, session limits, and isolation of each workspace's data enforced in the database.
  • On-Prem Workers: record data processed on Customer's machines stays there unless Customer's configuration sends it; each Worker has its own key-based identity, enrolled with a one-time code and approved by a person.
  • Logging and monitoring: audit and security logs of access and administrative actions, alerting on suspicious activity.
  • Resilience: redundant infrastructure, backups, and tested recovery procedures.
  • Secure development: code review, dependency vulnerability checks, and security testing; vulnerability reports handled under a coordinated disclosure process.
  • Data minimization and deletion: data kept only as long as the Services or Customer's configuration need it, and deleted as Section 9 describes.
  • Incident response: a documented process for detecting, containing, notifying, and remedying Personal Data Breaches.
  • Personnel: confidentiality obligations and access limited to those who need it to provide the Services.

Annex III: Subprocessors

  • Cloudflare, Inc. (United States): network delivery and security of traffic to the Services.
  • Resend (United States): delivery of email notifications the Services send.

The Services are hosted on infrastructure operated by Neblex in data centers in the United States.